Protecting Mobile Codes Using the Decentralized Label Model

For protection of the confidentiality and integrity of the mobile codes, this paper proposes a new decentralized label model and a implementation of this model in Linux system, MCGuard. Using MCGuard, the owners can flexibly define their security policies to control the dissemination of their mobile codes just by labelling them. By intercepting system calls, MCGuard inserts an interposition layer between the processes and system calls to control the data flows of mobile codes and guarantee them not to be transmitted to insecure channels and manipulated by malicious principals. In MCGuard, the labelling and control of the mobile codes and their transmitting channels is performed at the level of standard operating system abstractions, and the labels can migrate between hosts. This makes the MCGuard applicable in mobile code systems composed of the stock Linux OS and existing mobile codes.